Consent di Era AI Tidak Cukup dengan Satu Checkbox

Kita semua tahu ritualnya.

Install aplikasi.

Muncul halaman panjang.

Scroll.

Centang: “I agree.”

Lanjut.

Tidak dibaca.

Bukan karena semua orang malas.

Sering kali pilihannya memang cuma dua: setuju atau keluar.

Model consent seperti ini sudah lama problematik.

AI membuatnya semakin kelihatan.

Karena satu data yang sama sekarang bisa punya banyak kehidupan.

Foto bisa dipakai untuk fitur utama.

Lalu untuk analytics.

Lalu untuk melatih model.

Lalu model membuat embedding.

Lalu dipakai personalization.

Lalu mungkin digabung dengan data lain.

Satu checkbox di awal susah menjelaskan seluruh rantai.

Indonesia sebenarnya punya prinsip hukum yang cukup jelas.

UU Pelindungan Data Pribadi menyatakan persetujuan, ketika menjadi dasar pemrosesan, harus sah secara eksplisit untuk satu atau beberapa tujuan tertentu yang telah disampaikan kepada subjek data.

Pengendali juga wajib memberi informasi tentang tujuan, jenis dan relevansi data, retensi, jangka waktu pemrosesan, dan hak subjek data.

Kalau permintaan persetujuan memuat tujuan lain, persetujuan itu harus dapat dibedakan jelas, mudah diakses, dan menggunakan bahasa sederhana.

Jadi hukum kita sendiri tidak mengatakan: “pokoknya ada checkbox, aman.”

Persetujuan harus punya makna.

AI membuat tujuan pemrosesan lebih mudah melebar

Aplikasi kamera awalnya: “upload foto untuk edit.”

Fair.

Beberapa bulan kemudian: “kami juga ingin memakai foto untuk meningkatkan model.”

Different purpose.

Lalu: “kami ingin membuat fitur face personalization.”

Different again.

Product evolves.

Consent juga harus.

Jangan menganggap persetujuan 2024 otomatis berlaku untuk semua capability 2026.

UU PDP mewajibkan pemberitahuan sebelum perubahan informasi pemrosesan ketika relevan dalam mekanisme consent.

Secara product, ini berarti consent harus punya lifecycle.

Not one-and-done.

Kalau purpose berubah material, user perlu tahu.

“Improve service” terlalu elastis

Ini salah satu frase favorit privacy policy.

Apa artinya?

Fix bug?

Train recommendation?

Human review?

Train foundation model?

Build advertising profile?

Semua bisa disebut improve.

User tidak bisa memberi meaningful consent terhadap kalimat yang hampir mencakup apa saja.

AI product perlu lebih spesifik.

“Gunakan percakapan untuk melatih model generatif.”

Clear.

“Gunakan voice sample untuk membuat clone suara yang hanya tersedia di akun Anda.”

Clear.

“Gunakan meeting transcript untuk menghasilkan summary dan simpan 90 hari.”

Clear.

Specificity is human.

Legal language yang kabur tidak otomatis lebih aman.

Consent perlu granular

Bayangin AI photo app.

User mungkin setuju: foto diproses untuk membuat image.

Tapi tidak setuju: foto disimpan setahun.

Tidak setuju: dipakai training.

Tidak setuju: dipakai marketing.

Kalau semua dibundel satu checkbox, pilihan hilang.

Granular consent: Use feature. Save history. Improve model. Marketing.

Separate.

Tidak semua harus optional jika memang necessary untuk service.

Kalau feature membutuhkan processing, jelaskan.

Tapi secondary use should not piggyback silently.

Ini bukan cuma compliance.

Trust.

Orang lebih nyaman ketika tahu boundary.

“Reject all” harus benar-benar bisa ditemukan

Consent UX sering nakal.

Accept besar.

Manage kecil.

Reject di menu ketiga.

Kalau user harus menyelesaikan puzzle untuk menolak, choice questionable.

Dark pattern.

Untuk AI, stakes lebih tinggi karena data bisa berupa: voice, face, conversation, file.

Design should make yes and no understandable.

Not necessarily identical button design in every case, but no manipulation.

Privacy choice should not feel like game level.

Jakarta commuter yang lagi daftar aplikasi sambil berdiri di MRT tidak akan membaca 12 screen.

Design for real human context.

Progressive disclosure lebih masuk akal

Jangan jelaskan semuanya saat install.

Jelaskan saat feature digunakan.

User pertama kali aktifkan voice clone: “kami butuh rekaman suara. Ini digunakan untuk X. Disimpan Y. Bisa dihapus di sini.”

That moment.

User first connects Google Drive: “assistant will access files you select.”

Just-in-time.

This is better comprehension.

General privacy policy remains.

But decision-specific notice comes when relevant.

Consent is interaction, not document.

Connected apps membuat consent bertingkat

AI minta akses Drive.

User setuju.

Apakah itu berarti semua file?

Folder tertentu?

Can AI remember derived info?

Can it train?

Can third-party plugin see?

Permission needs scope.

OAuth already teaches us: read email, calendar, contacts.

AI needs similar granularity.

“Access your Google account” too broad.

Read-only.

Specific folder.

No write.

Temporary.

Permission should match task.

Agentic AI makes this critical.

Consent untuk tindakan berbeda dari consent untuk data

User says: “AI boleh baca inbox.”

Does that mean: boleh kirim email?

No.

Read permission and action permission separate.

AI agent can create real-world consequence.

Consent architecture must distinguish: see, suggest, act.

Maybe user comfortable assistant drafting.

Not sending.

Tool permission needs explicit boundary.

This is “consent” as authorization, not only privacy consent.

Legal categories differ, but user experience connects.

One checkbox cannot express autonomy level.

Memory needs separate control

“Use chat history.”

“Remember key preferences.”

Different.

A user might want history for search but no cross-chat memory.

Or memory for work preference but not personal.

Products should give clear scope.

OpenAI’s current memory design, for example, distinguishes saved memories and chat-history reference with user controls.

The broader lesson: persistence should be visible.

AI that remembers quietly can surprise.

Consent to chat today isn’t necessarily consent to be remembered next month.

There should be easy “forget this.”

Not ticket.

Children make checkbox consent even weaker

UU PDP requires child data processing to be conducted specifically and obtain parent or guardian consent according to law.

PP TUNAS adds age-appropriate product obligations.

But parent checkbox still isn’t enough by itself.

Child needs age-appropriate explanation.

Parent needs practical control.

Company needs data minimization.

High-risk processing may need impact assessment.

Consent is one layer.

Not shield.

If product collects unnecessary child biometric, “parent agreed” does not magically make design wise.

Data protection is more than permission.

Employees also don’t always have free consent

Workplace AI.

Company says: “agree to face recognition attendance.”

Can employee realistically say no?

Power imbalance.

This is why organizations should not over-rely on consent when another lawful basis and proper safeguards are more appropriate under applicable law.

UU PDP recognizes several legal bases for processing, not only consent.

This is important.

Consent shouldn’t be checkbox theater used everywhere.

Choose correct basis.

Then provide rights and transparency.

Withdrawal must be practical

UU PDP provides that when consent is withdrawn, the controller must stop processing within the statutory timeframe, subject to applicable provisions.

Product UX should make withdrawal possible.

If signup takes one tap but withdrawal requires letter, imbalance.

For AI: stop training future data.

Delete stored memory where applicable.

Disconnect app.

Remove voice clone.

What about model already trained?

This is technically harder.

Company must explain limitation upfront.

Don’t promise impossible “we can remove your influence from every parameter instantly” unless can.

Transparency about technical reality is better.

Consent receipts could help

Imagine privacy dashboard shows:

May 3: allowed voice processing for transcription.

May 10: allowed meeting storage 90 days.

June 1: declined model training.

July 8: connected Drive, folder Project A only.

This is understandable.

User sees choices.

Company has evidence.

UU PDP requires controller to be able to demonstrate consent where consent is relied upon.

Consent receipt aligns.

No need legal jargon.

Date, purpose, status.

Simple.

AI should ask again when context changes materially

A new model can do more with same data.

If use changes: re-consent or at least clear notification depending legal basis and nature of change.

Example: app collected voice for transcription.

Now wants voice cloning.

That’s a major change.

Don’t hide in terms update.

Ask.

Human expectation test: would user be surprised?

If yes, strong signal more transparency needed.

“Consent fatigue” is real

Too many popups.

People click.

So solution isn’t more checkboxes.

Better prioritization.

Ask only when choice meaningful.

Use defaults that protect.

Avoid secondary collection.

Bundle only genuinely related purposes.

Design around user comprehension.

Privacy teams sometimes respond to complexity with 30 toggles.

That’s not always better.

A tired user doesn’t become informed because options doubled.

Good consent is concise and contextual.

There is also a cultural layer

In Indonesia, many users share devices.

Family WhatsApp.

Office laptop.

One phone for parent and child.

“User consented” may not equal current person consented.

AI personalization can misread identity.

Shared-device mode.

Profile.

Logout.

Age setting.

This is local texture often missed by global product.

Consent architecture assumes one device, one person.

Reality messier.

Product should account.

Consent in AI also needs downstream visibility

User shares photo with app A.

App A sends to model provider B.

Maybe storage C.

Who processes?

You don’t need list 47 subprocessors on first screen.

But there should be accessible information.

Major provider changes should be notified when relevant.

Supply chain is part of transparency.

User’s consent to one brand shouldn’t hide an ecosystem.

Consent Di Era AI Tidak Cukup dengan Satu Checkbox because AI turns data into a moving asset.

It can be analyzed, remembered, combined, inferred from, and used to act.

A static “I Agree” moment cannot realistically govern every future use.

The better model is ongoing control.

Specific purposes.

Contextual notice.

Granular permissions.

Easy withdrawal.

Visible memory.

Action confirmation.

Age-appropriate explanation.

Ada satu problem yang makin kelihatan ketika AI masuk kehidupan sehari-hari: consent sering diberikan oleh orang yang salah.

Meeting recorder diaktifkan host.

Apakah semua peserta setuju?

Employee mengunggah customer data.

Apakah customer pernah setuju data diproses oleh tool itu?

Orang tua mengunggah foto anak.

Apakah child interest dipertimbangkan?

Satu orang menekan tombol tidak otomatis menyelesaikan hak semua pihak yang datanya ikut masuk.

Ini especially relevant untuk AI karena satu input bisa berisi banyak orang.

Screenshot Slack.

Rekaman meeting.

Foto grup.

Spreadsheet customer.

Consent architecture perlu melihat siapa data subject sebenarnya.

Kadang consent bahkan bukan dasar hukum yang tepat.

UU PDP mengenal beberapa basis pemrosesan selain persetujuan, seperti kewajiban kontrak, kewajiban hukum, kepentingan vital, kepentingan umum, dan kepentingan sah dalam kondisi yang ditentukan.

Jadi perusahaan jangan menjadikan checkbox sebagai ritual untuk semua hal.

Pilih basis yang benar.

Lalu tetap transparan.

Ini lebih jujur dibanding meminta “consent” yang user sebenarnya tidak punya pilihan.

Ada juga konsep consent decay.

Persetujuan yang diberikan tiga tahun lalu mungkin technically masih tersimpan, tetapi konteks produk sudah berubah total.

AI yang dulu hanya autocomplete sekarang punya memory, voice, dan agent.

Apakah user masih memahami apa yang mereka setujui?

Perusahaan perlu trigger untuk refresh notice ketika capability berubah material.

Tidak harus setiap model update.

Tapi kalau fungsi baru mengubah cara data digunakan atau tingkat konsekuensi, bilang.

User tidak perlu dibombardir.

Justru perubahan yang penting akan lebih terlihat kalau notifikasi tidak muncul untuk hal receh.

Consent UX yang bagus pada akhirnya terasa seperti percakapan yang fair.

“Untuk fitur ini kami butuh X.”

“Kalau lo tidak mau, fitur Y tetap bisa dipakai.”

“Data disimpan sampai Z.”

“Kalau berubah pikiran, matikan di sini.”

Tidak dramatis.

Tidak penuh jargon.

Dan tidak mencoba memenangkan klik.

Karena tujuan consent bukan membuat angka opt-in setinggi mungkin.

Tujuannya memastikan keputusan pengguna memang keputusan.

And sometimes, no consent request at all because the company should simply not collect the data.

The most privacy-friendly checkbox is the one we never needed to show.